# WireGuard Tunnel Map
> **Version**: 3.2 (2026-07-02) -- pebble/timber migrated from Proxy1 to Shield (per-store isolation via Shield↔Origin)
> **Classification**: NEED_TO_KNOW - This file NEVER leaves the local workstation
> **Location**: `Y:\documents\source\WIREGUARD_MAP.md` (LOCAL ONLY per OPS-09)
> **Rule**: NEVER deploy this file to any server. Servers only know conf names + NODE_IDs.

---

## Tunnel Registry

| Conf Name  | Service Purpose          | Node A (ID) | Node B (ID)  | Live Port | Subnet           | PSK  | Status         |
|------------|--------------------------|-------------|--------------|-----------|------------------|------|----------------|
| wg7        | Management mesh          | 414342      | ALL          | 41820*    | 10.69.69.0/24    | NO   | ACTIVE         |
| lantern    | Bridge relay             | 558201      | 669427       | 39471     | 172.28.41.0/30   | YES  | ACTIVE         |
| rain       | Private relay (ROTATED)  | 414342      | 669427       | 53417     | 172.23.83.0/30   | YES  | ACTIVE         |
| umbrella   | Secondary relay          | 414342      | 669427       | 38471/57196 | 10.83.47.0/30  | YES  | ACTIVE         |
| gravel     | DNS relay                | 669427      | 199335       | 37747     | 172.29.11.0/30   | YES  | ACTIVE         |
| shale      | DDoS failover            | 244939      | 333941       | 47417     | 255.17.69.0/30   | YES  | ACTIVE         |
| hp-trap    | (honeypot - stale)       | 669427      | NONE         | 51820     | N/A              | N/A  | DECOMMISSIONED |
| wg_filter  | (stale Vault-Filter)     | 869377      | 333941       | 49617     | 255.17.69.8/30   | NO   | DECOMMISSIONED |
| wg-vault   | (orphan interface)       | 669427      | NONE         | N/A       | N/A              | N/A  | DECOMMISSIONED |
| compass    | Auth challenge-response  | ALL              | 869377 | 42783     | 172.28.47.0/28   | YES  | ACTIVE (7/7 — all nodes) |
| forge      | Tool telemetry mesh      | ALL              | 669427 | 45247     | 172.28.50.0/28   | YES  | NEW — deploy after approval |
| thread     | AI inference             | 558201      | 669427       | 44619     | 172.28.45.0/30   | YES  | ACTIVE         |
| pebble     | cleanpharma.cc traffic   | 414342      | 558201       | 39847     | 10.69.70.0/30    | YES  | ACTIVE (Shield↔Origin, via wg7 mesh) |
| timber     | cleanearth.cc traffic    | 414342      | 558201       | 40153     | 10.69.71.0/30    | YES  | ACTIVE (Shield↔Origin, via wg7 mesh) |
| fossil     | DNS zone management      | 558201      | 199335       | 43291     | 172.29.13.0/30   | YES  | ACTIVE         |
| wg10       | Extended mesh            | 414342      | (peer 10.70.70.6) | 51820   | 10.70.70.0/24    | ?    | ACTIVE (Shield only, no handshake — peer inactive) |

> **\*wg7 listen ports vary per node** (verified 2026-07-02): Shield=41820, Origin=41820, Proxy=44634, Filter=41820, DNS=41652, Engine=41820, Payment=41820, Vault=41652 (VERIFIED 2026-07-04 via firewalld audit)

### Compass Subnet Map (VERIFIED 2026-07-04)

| Node | compass IP |
|------|-----------|
| Vault (hub) | 172.28.47.1/28 |
| Shield | 172.28.47.2/28 |
| Origin | 172.28.47.3/28 |
| Proxy | 172.28.47.4/28 |
| Filter | 172.28.47.5/28 |
| DNS | 172.28.47.6/28 |
| Engine | 172.28.47.7/28 |
| Payment | 172.28.47.8/28 |

### Status Key
- ACTIVE = live and running on servers
- PENDING = name change needed (old descriptive name still live)
- STALE = config exists but peers are wrong (needs update)
- NEW = does not exist yet, needs creation
- UNKNOWN = needs investigation before any action

---

## Old Name to New Name Mapping

| Old Name (REMOVE)  | New Name (DEPLOY)  | Status                            |
|--------------------|--------------------|-----------------------------------|
| wg_bridge          | lantern            | DONE - live on 558201 + 669427    |
| wg-signer          | compass            | DONE - live on ALL 7 nodes + 869377 hub (Filter added 2026-07-03) |
| wg-maid            | thread             | DONE - live on 558201 + 669427    |
| wg-s1              | pebble             | DONE - MIGRATED to 414342 + 558201 (was 244939; moved 2026-07-02) |
| wg-s2              | timber             | DONE - MIGRATED to 414342 + 558201 (was 244939; moved 2026-07-02) |
| (new)              | fossil             | DONE - live on 558201 + 199335    |
| shale    | shale              | PARTIAL - live on 244939 ONLY (port 47417). 333941 has NO shale deployed — Filter deployment pending |

| wg_filter          | N/A                | DECOMMISSIONED on 869377          |
| wg-vault           | N/A                | DECOMMISSIONED on 669427          |

---

## Port Rotation Allowlist

Pre-approved ports for rotation. Never conflicts with existing services.
When rotating, pick randomly from this pool:

```
31247  31893  32417  32891  33547  34123  34679  35201  35847  36291
36847  37293  37841  38423  38917  39431  39873  40217  40693  41173
42317  42891  43417  43891  44317  44893  45247  45891  46317  46893
47417  47891  48417  48917  49217  49847  50291  50847  51347  51893
52417  52891  53417  53891  54317  54891  55247  55891  56317  56891
57417  57891  58317  58891  59247  59891
```

### Excluded Ports (never use)
- 41820 (wg7 management mesh - permanent)
- 49616 (old shale port — retired, do not reuse)
- 47417 (shale — Proxy↔Filter)
- 9922 (SSH)
- 8443 (dashboard)
- 8301 (Engine API)
- 45247 (forge — Engine mesh)
- 51820 (default WG - too obvious)
- 22, 80, 443, 53 (well-known)

---

## Subnet Rotation Pool

/30 subnets from 172.16.0.0/12 for service tunnel rotation.
When rotating, pick randomly from this pool:

```
172.16.33.0/30    172.17.91.0/30    172.18.47.0/30    172.19.13.0/30
172.20.77.0/30    172.21.51.0/30    172.22.19.0/30    172.23.83.0/30
172.24.37.0/30    172.25.61.0/30    172.26.17.0/30    172.27.43.0/30
172.28.71.0/30    172.29.29.0/30    172.30.53.0/30    172.31.11.0/30
172.16.97.0/30    172.17.23.0/30    172.18.81.0/30    172.19.47.0/30
172.20.13.0/30    172.21.67.0/30    172.22.39.0/30    172.23.91.0/30
```

---

## PSK Requirement

ALL tunnels MUST use Pre-Shared Keys (PSK) for post-quantum resistance.
Generate per tunnel: `wg genpsk > /path/to/psk`
Add to both peer configs: `PresharedKey = <key>`
PSK rotates alongside keypairs during tunnel rotation.

---

## Firewalld Zone Map

Each tunnel gets its own firewalld zone per NET-02:

| Conf Name  | Zone Name   | Allowed Ports                        |
|------------|-------------|--------------------------------------|
| wg7        | zone-mesh   | 9922/tcp (SSH + hello) ONLY — NO Engine API |
| forge      | zone-forge  | 8301/tcp (Engine API) ONLY              |
| lantern    | zone-lant   | 8301/tcp (Dashboard→Engine) ONLY        |
| rain       | zone-rain   | 8443/tcp (PaymentBridge) ONLY        |
| umbrella   | zone-umbr   | relay traffic ONLY                   |
| gravel     | zone-grav   | DNS management ONLY                  |
| shale      | zone-shale  | DDoS failover signals ONLY (port 80 from Proxy only) |
| compass    | zone-comp   | challenge-response ONLY              |
| thread     | zone-thrd   | inference API ONLY                   |
| pebble     | zone-pebl   | store 1 HTTP ONLY                    |
| timber     | zone-tmbr   | store 2 HTTP ONLY                    |
| fossil     | zone-fosl   | DNS zone update API ONLY             |

---

## Verification Checklist

For each tunnel, verify:
- [ ] Interface running with correct conf name
- [ ] PSK configured on both peers
- [ ] Firewalld zone created and active
- [ ] Handshake completing (< 2 min age)
- [ ] No node names in config comments (NODE_ID only)
- [ ] Config at stealth path (not /etc/wireguard/)
- [ ] Decoy config exists at /etc/wireguard/
- [ ] Old conf name removed from server
- [ ] Port is non-standard (not in excluded list)
